Design/Logic Flaw

2019-11-1816:15:00

PRIOn knowledge base

www.prio-n.com

4.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.7%

JSON

In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, triggering an exception that exposes underlying operating system details.

CPENameOperatorVersion
octopus_deployge3.3.0
octopus_deployle2019.10.4

CPE	Name	Operator	Version
	octopus_deploy	ge	3.3.0
	octopus_deploy	le	2019.10.4

References

github.com/OctopusDeploy/Issues/issues/5971